I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters?
User subnet 192.168.20.0/24, default route 192.168.20.1 HoneyD subnet 192.168.25.0/24. The IP used to reach here is 192.168.20.254.
The router has a static route entry for 192.168.25.0/24 via 192.168.20.254.
Everything works as I would expect except for getting all the traffic bound for 192.168.20.255 in my logs.
This is mostly from NETBIOS traffic but it happens elsewhere as well.
Note - I did review Honeyd: log grows too fast. Still seems there should be a way to address this without needing to restructure my network. I really do want the gateway to be sitting in a subnet that will be picking up real traffic.